Transcript Chapter 6 – Physical and Environmental Security

Chapter 6 – Physical and
Environmental Security
Physical and Environmental
Security
Physical security is extremely important. There is no point
in technical and administrative security controls if
someone can simply bypass them from physically
accessing systems.
• Physical security is harder today as systems are more
distributed (not just mainframes) and complex.
• Not just about protecting data, but more importantly
PEOPLE! (remember safety is always issues #1*)
• Often physical security is an afterthought when building
new facilities. 
• Lawsuits against companies CAN be filed if a company
does not take adequate physical security measures (see
next slide)
Some examples of physical
problems
• Banks with bushes to close or to high near
an ATM. Which allows criminals to hide or
blocks view of crimes
• Portion of an underground garage has
improper lighting
• Convenience store has too many signs
which robbers target because the view is
obstructed from the outside.
Threats to physical security
• Natural hazards (floods, tornadoes, fires,
temperatures)
• Supply system threats (power outage,
water, gas, WAN connection etc)
• Manmade threats (unauthorized access,
explosives, damage by disgruntled people,
accidents, theft)
• Politically motivated threats (strikes, riots,
civil disobedience)
Physical security fundamentals
• Life safety goals* should always be #1
priority
• Defense should be layered which means
that different physical controls should work
together to accomplish the goal of security.
(examples)
• Physical security can address all of the
CIA fundamental principals.
Planning Process
Threats should be classified as internal or external.
Risk analysis should be taken on a physical
aspect. Assets should be identified, threats
should be identified (probabilities calculated)
and countermeasures put in place that are
COST EFFECTIVE and appropriate to the level
of security needed.
Physical security will ultimately be a combination
of people, processes, procedures and
equipment to protect resources.
(more)
Planning Process
The planning and security program should include
the following goals.
• Deterrence – fences, guards, signs
• Reducing/Avoiding damage by Delaying
attackers – slow down the attackers (locks,
guards, barriers)
• Detection – motion sensors, smoke detectors
• Incident assessment – response of guards, and
determination of damage level
• Response procedures – fire suppression, law
enforcement notification etc
Planning process
Idea is to avoid problems if at all possible,
otherwise mitigate problems. This can be
best accomplished by layering (which we
already talked about). If a crime happens
you must be able to detect it, and
response should be implemented.
Remember this is the same process that we
cover in Rink Analysis! All the same
processes and concepts apply.
Target Hardening (410)
Focuses on denying access through
physical and artificial barriers. (alarms,
locks, fences). Target hardening can lead
to restrictions on the use, enjoyment and
aesthetics of an environment.
CPTED
An important security concept organizations
use is “Crime Prevention Through
Environmental Design” – The idea is that
proper design of a physical environment
can reduce crime by directly affecting
human behavior.* It provides guidance in
loss and crime prevention through properly
facility construction and environmental
components and procedures.
CPTED
CPTED concepts have been used since the 1960s
and have advanced as environments and crime
has advanced. CPTED is not just used for
corporate security but also for building
neighborhoods etc.
CPTED looks at the components that make up the
relationship between humans and their
environment.
(some examples CPTED guidelines are next)
CPTED guidelines
Examples
• Hedges and planters should not be more than
2.5 feet tall.
• Data center should be at the center of a facility.
• Street furniture should encourage people to site
and watch what is going around them.
• Landscaping should not provide places to hide.
• Put CCTV camera in plain view so criminals are
aware they are being watched and recorded.
CPTED
CPTED provides three main strategies to
bring together physical environment and
social behavior to increase overall
protection:
• Natural Access Control
• Natural Surveillance
• Territorial reinforcement
We will talk about these next
CPTED (Natural Access Control)
Natural Access Control – the guidance of
people entering and leaving a space by
the placement of doors, fences, lighting
and landscaping.
• Clear lines of sight and transparency are
used to discouraged potential offenders.
• Natural barriers can be used to create
physical security zones
CPTED (Natural Surveillance)
Natural Surveillance attempts to discourage
criminals by providing many ways for
others to observe potential criminal
behavior.
CPTED (Territorial Reinforcement)
Creating a space that emphasizes a
companies (sphere of influence) so
employees feel ownership of that space.
The idea is that they will “protect” the
environment (report suspicious activities).
It can also make criminals feel vulnerable
or that they don’t belong there.
Some examples are
(next)
CPTED (Territorial Reinforcment)
•
•
•
•
•
•
•
•
Decorated Walls
Fences
Lanscaping
Lights
Flags
Company signs
Decorative sidewalks
Company “activities” (ie. Barbeques)
y
A good approach is to design generically
using CPTED and then apply target
hardening concepts where appropriate.
• Zones are used to physically separate
areas into different security areas.
Designing a Physical Security
Program
When designing a physical security program you
must consider the following
• HVAC systems
• Construction materials
• Power distribution systems
• Communications lines
• Hazardous materials
• Proximity to airports, highways, roads
• Proximity to emergency service
• etc
Facilities
When building a new facility there are several
considerations
• Visibility
• Surrounding area and external entities
– Crime rate
– Proximity to police, medical and fire stations
• Accessibility
– Roads/access
– Traffic
– Proximitty to airports etc.
• Natural disasters
– Probability of floods, huricanes
– Hazardous terrain (mudslides, falling rocks (really?!?), excessive
snow or rain)
Construction
Different considerations need to be
considered when building a facility
depending on what the facility is trying to
protect and. For example (if documents
are stored, fire-resistant materials should
be used)
(read the bullet points on 418/419) you
should memorize these.
Entry Points
Entry points into a building or control zone
must be secured.
• including windows
• Including ventilation ducts etc.
All components of a door should be equally
as strong. (no use to have a strong steel
door, but weak hinges) (weakest link)
(more)
Doors
• Fire codes dictate that exit bars be on
doors.
• Doors can be hollow core or solid core,
hollow core doors should only be user
internally.
• Doors with automatica locks can be
– Failsafe* - what does this mean?
– Failsecure* - what does this mean?
Mantrap
• What is it?
• What is piggybacking?
Windows
There are different type of windows that you
should now about
• Standard glass – residental home/easily broken
• Tempered glass – glass that is heated and then
suddenly cooled. 5-7x stronger than regular
glass
• Acrylic glass (plexiglass/lexan) – stronger than
regular glass, but gives off toxic fumes if burnt.
(more)
Windows
• Glass with embedded wires – avoids glass
shattering
• Laminated glass – two sheet of glass with
a plastic film in between. Harder to break.
• Glass can be treated with films to tint for
security.
Computer Room
Computer rooms are where important servers and
network equipment is stored.
• Equipment should be placed in locked racks.
• Computer rooms should be near the center of
the building, and should be above ground, but
not too high that it would be difficult to access by
emergency crews
• Strict access control should be enabled.
• They should only have 1 access door, though
they might have to have multiple firedoors
(more)
Computer Room
• Computer Room should have positive air
pressure*
• There should be an easy to access emergency
off switch
• Portable fire extinguishers
• Smoke/fire sensors should be under raised
floors.
• Water sensors should be under raised floors and
on ceilings
(more)
Computer Room
• Temperature and Humidity levels should
be properly maintained
– Humidity too low, static electricity*
– Humitdity too high, corrosion of metal parts*
• CR should be on separate electrical
systems than the rest of the building
• Should have redundant power systems
and UPS
Protecting Assets (429)
Companies must protect from theft. Theft of laptops is a big
deal especially if private information is on the laptop. You
should understand best practices in regards to physically
protecting things from being stolen.
• Inventory all laptops including serial number
• Harden the OS
• Password protect the BIOS
• Use disk encyrption on laptops
• Do not check luggage when flying
• Never leave a laptop unattended
• Install tracking software on laptops (lowjack type
software)
(more)
Protecting Assets
You should also be aware of the types of
safes that exist
• Wall safe
• Floor safe
• Chest (stand alone)
• Depositories (safes with slots)
• Vaults (walk in safes)
Internal Support Systems
Power is critically important for data
processing we will talk about some
different power issues and concerns to be
aware off.
Power
• UPS
– Online
– Standby
• Power line conditioners
• Backups generators
Electric power issues
There power interference that stops you
from getting “clean power” this is called
“line noise”.
• Eletromagnetic Interference –
electromagnetic that can create noise.
(motors can generate fields)
• Radio Frequency Interference –
fluorescent lights
Electrical Power Issues
There are times where the voltage delivered falls outside
normal thresholds
Excess
• Spike – momentary high voltage
• Surge – prolonged
Shortage
• Sag/dip – momentary low voltage
• Browout – prolonged low voltage
Loss
• Fault – momentary outage
• Black out
Electrical power issues
• “In rush current” – when a bunch of things
are turned on, power demands are usually
higher, and may stress power supplies,
causing a sag/dip
• Try to have computer equipment on
different electrical supplies. Do not use
microwaves or vacuums on computer
power lines.
Power best practices
• Use surge protectors on desktops
• Do not daisy change surge protectors
• Employ power monitor to detect current and
voltage changes
• Use regulators or line conditioners in computer
rooms
• Use UPS systems in computer rooms
• If possible shield power cables
• Do not run power over or under fluorescent
lights
Environmental Issues
Improper environments can cause damage to
equipment or services
Water and Gas
• Make sure there are shutoff valves and that they
have positive drains (flow out instead of in,
why?)
• Humidity
– Humidity must not be too high or too low
• Low – static
• High – rust/corrosion
– Hygrometer measures humidity
(more)
Environmental Issues
• Static electricity – besides ensuring proper
humidity
– use anti-static flooring in data processing
areas
– Don’t use carpeting in data centers
– Wear anti-static bands when workign inside
computers.
Environmental Issues
Temperature – should not be too high. Room
temps should be in the 60s ideally.
Ventilation
• should be “closed loop” (re-circulating)
• Positive pressure (air flows out, ex, smoke
and contaminants will be pushed out
rather than flow in)
Fire prevention
It’s obvious that you should have fire prevention,
detection and supression systems. Which types
you use depends on the environment.
Fire detection systems –
• Smoke activated (using a photoelectrical device)
• Heat activated
– Rate of rise sensors
– Fixed temperature sensors
(more)
Fire prevention systems
Detectors need to be properly placed
• On and above suspended ceilings
• Below raised floors
• Enclosures and air ducts
• Uniformly spread through normal areas
Fire suppresion (444)
A fire needs fuel, oxygen and high temperatures to
burn. There are many different ways to stop
combustion
fuel – soda acid (remove fuel)*
oxygen – carbon dioxide (removes oxygen)*
Temperature – water (reduces temperature)*
Chemical cumbustion – gas (interferes with the
chemical reactions)*
Fire Suppression
Different fire suppression types based on
class of fire
• A
• B
• C
• D
(we’ll talk about each of these)
Fire Supression
A – Common Combustibles
• Use for: Wood, paper, laminates
• Uses water or foam as suppression
agent
B – Liquid
• Use for: gas or oil fires
• Ues: Gas (CO2), foam, dry powders
Fire Suppression
C – Electrical
• Use on: electrical equipment and wires
• Uses: Gas, CO2, dry powder
D – Combustible materials
• Use on: combustible chemicals (sodium,
potassium)
• Uses: dry powder
Fire Suppression (Halon)
Before any type of dangerous gas (Halon, CO2) is
released there should be some type of warning
emmitted. (CO2 will sufficate people)
Halon is a type of gas that used to be commonly
used, it is no longer used do to CFCs. (it is also
dangerous to people). It was banned by the
“Montreal protocol”* in 1987. effective
replacement is FM-200 or others on top of pg
444*
Fire Suppression Note
HVAC system should be set to shutdown
when an automatical supression system
activates.
Now we need to understand automatic fire
supression systems
Automatic fire supression
Sprinklers –
• Wet Pipe
• Dry Pipe –
• Preaction – like dry pipe, but a delay exists
before release. Best for computer rooms if
a water based system is used.
• Deluge – High volume of water dispersal,
not used for data centers.
Fire random tidbit
The space between the “ceiling” and the
actual floor above is called the “plenum”.
You should know this term, you should
understand that when running network
cables and other plastics insulated wiring,
you need to use a certain type of wire
called “plenum” wire, this is because
burning plastic gives off toxic gases and
small fires in plenum areas could distribute
toxic gases throughout the building air
systems.
Perimeter security
Perimeter security is concerned with protecting the outside
of your facility, that is ensuring that nobody unauthorized
gets inside to cause any security violations. Perimeter
security can implement multiple controls to keep the
facility secure
Some controls that are used that we will look at are
• Locks
• Personnel access controls
• Fencing
• Lighting
• Bollards
• Surveillance devices
• Intrusion detection systems
• Guard dogs
Perimeter Security
Locks – purpose of locks is to DELAY*
intruders, until they can be detected and
apprehended. There are multiple types of
locks that we will talk about
• Mechanical
• Combination locks
• Cipher locks
Locks
• Mechanical – use a physical key (Warded
lock or tumbler)
– Warded lock – basic padlock, cheap
– Tumbler lock – more piece that a warded lock,
key fits into a cylinder which moved the metal
pieces such that the bolt can slide into the
locked and unlocked position.
• Pin tumbler – uses pins
• Wafer – uses wafer (not very secure)
Locks types (453)
There are different lock grades
• Grade 1 – commercial
• Grade 2 – heavy duty residential, light
commercial
• Grade 3 – residential throw away locks
There are also 3 cylinder categories
Low – no pick or drill resistance provided
Medium – a littl pick resistance
High – higher degree of pick resistance
Attacks against key type locks
Tension wrench – shaped like an L and is
used to apply tensino to the cylinder, then
use a pick to manipulate the individual
pins.
Locks
• Combination locks – rather than use a key,
turn
• Cipher locks – electronic locks
– Combination can be changed
– Combination can be different for different
people
– Can work during different times of day
– Can have emergency codes
– Can have “override codes”
Locks
Device Locks - Computer equipment sometimes
must be locked (laptops, or physically blocking
out slots). Some type of device locks are
• Switch controls
• Slot locks physically lock into the expansion
slots to physically secure systems.
• Port controls – block acess to floppy or USB
ports
• Cable traps – lock down cables from being
unplugged and removed.
Personnel access controls
There are different technogies to grant
access to a building.
• User activiated – a user does something
(swipe cards, biometrics)
• Proximity devices/transponders – a
system recongizes the presence of an
object. (Electronic access control tokens)
is a generic term for proximity
authentication systems)
Fencing
Can deter and delay intruders
• Fences 3-4 feet high only deter casual
trespassers
• Fences 6-7 feet high are considered too
high to climb easily
• Fences 8 feet high should are considered
serious.
(more)
Fencing
Memorize the gauges and mesh size chart
on pg 457
Fencing best practices
• Fenses should be a first line of defence
• Critical areas should have fences of 8 feet.
Bollards
Bollards are small concrete pillars,
sometimes containing lights or flowers.
They are used to stop people from driving
through a wall, often put between a
building and parking lot.
They can be arranged to form a natural path
for walking.
Lighting
Lighting is obviously important in perimiter
security. It decreases the probability of
criminal activity.
• Each light should cover it’s own zone and
there should not be gaps in the coverage
• Coverage in fact should overlap.
• Lighting should be directed AWAY from the
security gaurds etc.
Surveillance
Surveillance systems are a detective control.
Genearlly these are CCTV systems.
CCTV systems consist of
• Cameras
• Transmitters
• Receivers
• Recording systems
Surveillance
Most camera are “charged coupled devices”
that takes light from a lens and turns it into
an electrical signal.
There are two types of lenses in CCTV
camera
• Fixed focal length
• Variable focus length (zoom lens)
We will define focal length next slide
(more)
Survellance
• Focal Length – relates to the amount of area can
be seen. Wide angles lenses use small focal
lengths*. Narrow angles use long focal lengths*.
If you don’t have a CCTV camera that can
change, you must pick an appropriate focal
length for your application.
• Generally you should have cameras with autoirises that can adjust to how bright the outside
consitions are
• Zoom lenses allow you to change
• PTZ cameras (pan, tilt, zoon)
Intrustion Detection Systems
IDS (physical IDS, NOT network IDS) – help
detect the physical presence of an
intruder.
Can be multiple types.
Electromechanical – traditional types,
determine a openining of a window by a
break in connectivity.
– Vibration sensors are also electromechanical
– Pressure pads are also electromechanical
IDS
Photoelectric – uses light beams to decect when
something crosses the beam.
Passive Infrared (PIR) – monitors heat signatures
in a room. (a lot of home automatical light
systems are of this type)
Acoustical Detection – uses sound
Proximity detector/capacitance detectors – emits a
measurable magnetic field. If field is disrupted it
sets off the alarm. (usually this field is a very
small area, as magnetic fields disperse quickly
as the area increases)
Patrols and Gaurds
• Obvious – and provide a dynamic
response, gaurds can make decisions
based on the situation, which most other
IDS cannot.
• Dogs – highly useful in detecting intruders
and discouraging attacks.